diff --git a/docs/OSVAUCO_OPAX_SESSION_LOG.md b/docs/OSVAUCO_OPAX_SESSION_LOG.md
index 2ccb840..fb329de 100644
--- a/docs/OSVAUCO_OPAX_SESSION_LOG.md
+++ b/docs/OSVAUCO_OPAX_SESSION_LOG.md
@@ -295,3 +295,9 @@ Bootstrap Emma på VM: synk Gitea fra GitHub, deretter kjør emma/setup.sh
 - Slutt  : 2026-09-07 20:17 UTC
 - Gjort  : mye planlegging lite handling
 - Uløst  : ja vi knekte den med å styre for mye, den endte opp å spørre om alt til sliutt og ingen automatikk
+
+### Sesjonsavslutning 20260909-093742
+- Start  : 2026-09-09 09:37 UTC
+- Slutt  : 2026-09-09 09:37 UTC
+- Gjort  : (ingen notat)
+- Uløst  : ingen
diff --git a/opax-mcp/test_mcp_tools.py b/opax-mcp/test_mcp_tools.py
index 1cda403..0390d92 100644
--- a/opax-mcp/test_mcp_tools.py
+++ b/opax-mcp/test_mcp_tools.py
@@ -314,6 +314,24 @@ class TestMcpHandlerDispatch:
         assert json_res["error"]["code"] == -32601
         assert json_res["error"]["message"] == "Tool not allowed or not found."
 
+    async def test_rejects_allowed_tool_with_malicious_path_traversal(self, mcp_secret):
+        """
+        Confirms that an ALLOWED tool (read_repo_file) still rejects a request
+        with a malicious path traversal argument at the handler level. This tests
+        that the tool's internal validation is triggered correctly.
+        """
+        response = await self.make_rpc_call(
+            "read_repo_file",
+            mcp_secret,
+            params={"path": "../../../etc/passwd"}
+        )
+
+        assert response.status_code == 200
+        json_res = response.json()
+        assert "result" not in json_res
+        assert "error" in json_res, "The response should contain a JSON-RPC error object"
+        assert json_res["error"]["code"] == -32000, "Expected a generic server error for a validation failure"
+
     @pytest.mark.parametrize(
         "allowed_tool", sorted(WEB_AGENT_ALLOWED_TOOLS)
     )
diff --git a/scripts/opax.sh b/scripts/opax.sh
index c22e3cb..a65f946 100755
--- a/scripts/opax.sh
+++ b/scripts/opax.sh
@@ -9,10 +9,27 @@
 # =============================================================================
 
 OSVAUCO_DIR="${OSVAUCO_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
-export GOOGLE_CLOUD_PROJECT="propane-will-491900-m5"
-export GOOGLE_CLOUD_LOCATION="us-central1"
-export VERTEX_AI_LOCATION="us-central1"
-export GEMINI_MODEL="gemini-2.5-pro"
+
+OPAX_GEMINI_MODEL_WAS_SET=0
+if [[ -n "${GEMINI_MODEL:-}" ]]; then
+  OPAX_GEMINI_MODEL_WAS_SET=1
+fi
+# --- Configurable environment variables ---
+# Set defaults only if variables are unset or empty. Allows user overrides.
+: "${GOOGLE_CLOUD_PROJECT:=propane-will-491900-m5}"
+export GOOGLE_CLOUD_PROJECT
+
+: "${GOOGLE_CLOUD_LOCATION:=us-central1}"
+export GOOGLE_CLOUD_LOCATION
+
+: "${VERTEX_AI_LOCATION:=${GOOGLE_CLOUD_LOCATION}}"
+export VERTEX_AI_LOCATION
+
+: "${GEMINI_MODEL:=gemini-2.5-pro}"
+export GEMINI_MODEL
+
+: "${GOOGLE_GENAI_USE_VERTEXAI:=true}"
+export GOOGLE_GENAI_USE_VERTEXAI
 HANDOFF="$OSVAUCO_DIR/docs/HANDOFF.md"
 MASTERPLAN="$OSVAUCO_DIR/docs/MASTERPLAN.md"
 ROADMAP="$OSVAUCO_DIR/docs/ROADMAP.md"
@@ -31,6 +48,61 @@ NC="$(tput sgr0 2>/dev/null || printf '\033[0m')"
 OK="✔"
 FAIL="✗"
 
+select_gemini_model() {
+  if [[ "$OPAX_GEMINI_MODEL_WAS_SET" -eq 1 ]]; then
+    return 0
+  fi
+
+  if [[ ! -t 0 || ! -t 1 ]]; then
+    return 0
+  fi
+
+  printf "\n${BOLD}${WHITE}Velg Gemini-modell${NC}\n"
+  printf "  1) Gemini 3.1 Pro Preview  ${DIM}(gemini-3.1-pro-preview)${NC}\n"
+  printf "  2) Gemini 3.1 Flash-Lite   ${DIM}(gemini-3.1-flash-lite)${NC}\n"
+  printf "  3) Gemini 2.5 Pro          ${DIM}(fallback/default)${NC}\n"
+  printf "  4) Custom Gemini model ID\n"
+  printf "  5) Custom / Model Garden model ID ${DIM}(advanced/unvalidated)${NC}\n"
+
+  local choice custom_model
+  read -r -p "Velg [1-5, Enter=3]: " choice || return 0
+
+  case "${choice:-3}" in
+    1)
+      GEMINI_MODEL="gemini-3.1-pro-preview"
+      ;;
+    2)
+      GEMINI_MODEL="gemini-3.1-flash-lite"
+      ;;
+    3)
+      GEMINI_MODEL="gemini-2.5-pro"
+      ;;
+    4)
+      read -r -p "Oppgi Gemini model ID: " custom_model || return 1
+      if [[ -z "$custom_model" ]]; then
+        printf "${RED}Model ID kan ikke være tom.${NC}\n"
+        return 1
+      fi
+      GEMINI_MODEL="$custom_model"
+      ;;
+    5)
+      printf "${YELLOW}Merk: Denne verdien sendes direkte til Gemini CLI som --model. OPAX konfigurerer ikke Vertex-endpoint, deployer ikke Gemma og verifiserer ikke kompatibilitet.${NC}\n"
+      read -r -p "Oppgi model ID som støttes av installert Gemini CLI: " custom_model || return 1
+      if [[ -z "$custom_model" ]]; then
+        printf "${RED}Model ID kan ikke være tom.${NC}\n"
+        return 1
+      fi
+      GEMINI_MODEL="$custom_model"
+      ;;
+    *)
+      printf "${YELLOW}Ugyldig valg; bruker Gemini 2.5 Pro.${NC}\n"
+      GEMINI_MODEL="gemini-2.5-pro"
+      ;;
+  esac
+
+  export GEMINI_MODEL
+}
+
 run_check() {
     local desc="$1" cmd="$2" err="$3" critical="${4:-false}"
     printf "  %-42s" "$desc"
@@ -55,6 +127,8 @@ run_check() {
     fi
 }
 
+select_gemini_model || return 1
+
 clear
 printf "${CYAN}${BOLD}"
 cat << 'LOGO'
@@ -64,8 +138,7 @@ cat << 'LOGO'
  | |_| |___) |    \ V / (_| | |__| |_| | |___| |_| |
   \___/|____/      \_/ \__,_|____|\___/ \____|\___/
 LOGO
-printf "${NC}${BOLD}${CYAN}        OS VAUCO  /  OPAX${NC}${DIM}  ·  Gemini 2.5 Pro${NC}
-"
+printf "${NC}${BOLD}${CYAN}        OS VAUCO  /  OPAX${NC}${DIM}  ·  Gemini CLI / Vertex AI${NC}\n"
 printf "${DIM}  ─────────────────────────────────────────────${NC}
 "
 printf "  ${CYAN}project=${NC}%s  ${CYAN}region=${NC}%s
@@ -78,7 +151,8 @@ printf "${DIM}  ─────────────────────
 
 printf "${BOLD}${WHITE}Preflight${NC}
 "
-run_check "gcloud auth"            "gcloud auth print-access-token"                          "Kjør: gcloud auth login --no-launch-browser" true || return 1
+run_check "Vertex AI ADC"          "gcloud auth application-default print-access-token"      "ADC not found. On GCE, attach service account. Locally, run: gcloud auth application-default login" true || return 1
+run_check "gcloud CLI (optional)"  "gcloud auth print-access-token"                          "CLI not logged in. Needed for deploy commands." false
 run_check "project = $GOOGLE_CLOUD_PROJECT" "[[ "$(gcloud config get-value project 2>/dev/null)" == "$GOOGLE_CLOUD_PROJECT" ]]" "Kjør: gcloud config set project $GOOGLE_CLOUD_PROJECT" false
 run_check "HANDOFF.md finnes"      "[[ -f '$HANDOFF' ]]"                                     "Mangler: $HANDOFF" false
 run_check "MASTERPLAN.md finnes"   "[[ -f '$MASTERPLAN' ]]"                                  "Mangler MASTERPLAN" false
@@ -106,7 +180,7 @@ ${GREEN}${BOLD}→ Starter gemini...${NC} (laster kontekst fra .gemini/GEMINI.md
 
 "
 
-gemini
+gemini --model "$GEMINI_MODEL"
 GEMINI_EXIT=$?
 
 # =============================================================================